From nobody Fri Jun 4 10:06:15 2021 X-Original-To: pf@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 644C413A6438; Fri, 4 Jun 2021 10:06:26 +0000 (UTC) (envelope-from thomas@gibfest.dk) Received: from smtp2.servers.tyknet.dk (smtp2.servers.tyknet.dk [89.233.43.78]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4FxJM54RHnz4mFv; Fri, 4 Jun 2021 10:06:25 +0000 (UTC) (envelope-from thomas@gibfest.dk) To: pf@freebsd.org, stable@freebsd.org DKIM-Filter: OpenDKIM Filter v2.10.3 smtp2.servers.tyknet.dk 9EB2316611 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=gibfest.dk; s=default; t=1622801176; bh=4Nk1WN6egRJ1dZPgTKaMZkEp4B5x95Wj175xK5UkH+I=; h=To:From:Subject:Date; b=OthRgWAXYfmybJqGUnz1lxxPToMpZ9W3bCa5+ZbRQwQu191FXEXuayApP2msK4hFT jed+eHYhlzNfOF9UBxGfr4BezU5RKyEUfH7E6SBZ9Nnoo4izjV8tdO0JDu9JUmBmmA 7TizwsUX0TG83TEcL3sMmfwK1/I6yw73hqpK8kkJ/wczYuyOyhvuJlJLWNmjqvZ9BK 2xE3UCyyGDI/WnnvVO9e9JJZGpB48Z14Jgut2asoqhSmndJas7oTmCDgtUAsdYz86G 9Mtm56Xeq4Dt9VDpUz9K3BcVOZ51Kgt4c9iBrWpXTFZl5Gkq1yJpESJCqOVAeJqKe7 0npPRIpXRa2YQ== Subject: New pf_default_rules option and patch Message-ID: <4ed0ba0c-74d8-003d-86c4-c6265118d600@gibfest.dk> Date: Fri, 4 Jun 2021 12:06:15 +0200 List-Id: Technical discussion and general questions about packet filter (pf) List-Archive: https://lists.freebsd.org/archives/freebsd-pf List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-pf@freebsd.org X-BeenThere: freebsd-pf@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: 4FxJM54RHnz4mFv X-Spamd-Bar: --- Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gibfest.dk header.s=default header.b=OthRgWAX; dmarc=pass (policy=reject) header.from=gibfest.dk; spf=pass (mx1.freebsd.org: domain of thomas@gibfest.dk designates 89.233.43.78 as permitted sender) smtp.mailfrom=thomas@gibfest.dk X-Spamd-Result: default: False [-4.00 / 15.00]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; R_DKIM_ALLOW(-0.20)[gibfest.dk:s=default]; FREEFALL_USER(0.00)[thomas]; FROM_HAS_DN(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; R_SPF_ALLOW(-0.20)[+mx]; MIME_GOOD(-0.10)[text/plain]; TO_DN_NONE(0.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; SPAMHAUS_ZRD(0.00)[89.233.43.78:from:127.0.2.255]; DKIM_TRACE(0.00)[gibfest.dk:+]; RCPT_COUNT_TWO(0.00)[2]; DMARC_POLICY_ALLOW(-0.50)[gibfest.dk,reject]; NEURAL_HAM_SHORT(-1.00)[-0.997]; RCVD_COUNT_ZERO(0.00)[0]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; RBL_DBL_DONT_QUERY_IPS(0.00)[89.233.43.78:from]; ASN(0.00)[asn:3308, ipnet:89.233.0.0/18, country:SE]; MID_RHS_MATCH_FROM(0.00)[]; MAILMAN_DEST(0.00)[pf,stable] Reply-To: thomas@gibfest.dk From: Thomas Steen Rasmussen via pf X-Original-From: Thomas Steen Rasmussen X-ThisMailContainsUnwantedMimeParts: N Hello pf@ and stable@, I opened a bug with a patch to support loading $pf_default_rules - which defaults to "block drop log all" - in case loading pf.conf fails during boot. This is to avoid having 0 rules loaded. The default is to have the new feature disabled, keeping the existing behaviout. The bug and patch and more info can be seen at [1]. Questions welcome, here or in the bug. Best regards, Thomas Steen Rasmussen [1] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256410 From nobody Sat Jun 5 01:03:36 2021 X-Original-To: pf@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 59A4B928DAE for ; Sat, 5 Jun 2021 01:03:36 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4FxhGJ1wNSz3QCV for ; Sat, 5 Jun 2021 01:03:36 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 27E3B27526 for ; Sat, 5 Jun 2021 01:03:36 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 15513ae9074422 for ; Sat, 5 Jun 2021 01:03:36 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 15513alk074421 for pf@FreeBSD.org; Sat, 5 Jun 2021 01:03:36 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: pf@FreeBSD.org Subject: [Bug 256410] pf: Add pf_default_rules option Date: Sat, 05 Jun 2021 01:03:36 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: misc X-Bugzilla-Version: Unspecified X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: linimon@FreeBSD.org X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: pf@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: assigned_to Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Technical discussion and general questions about packet filter (pf) List-Archive: https://lists.freebsd.org/archives/freebsd-pf List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-pf@freebsd.org X-BeenThere: freebsd-pf@freebsd.org MIME-Version: 1.0 X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D256410 Mark Linimon changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|bugs@FreeBSD.org |pf@FreeBSD.org --=20 You are receiving this mail because: You are the assignee for the bug.= From nobody Sat Jun 5 19:06:13 2021 X-Original-To: pf@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 3CD231609DC6 for ; Sat, 5 Jun 2021 19:06:14 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Fy8HV1Bfrz3p9r for ; Sat, 5 Jun 2021 19:06:14 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 11ADF159D6 for ; Sat, 5 Jun 2021 19:06:14 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 155J6EAZ031554 for ; Sat, 5 Jun 2021 19:06:14 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 155J6Eu9031552 for pf@FreeBSD.org; Sat, 5 Jun 2021 19:06:14 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: pf@FreeBSD.org Subject: [Bug 256410] pf: Add pf_default_rules option Date: Sat, 05 Jun 2021 19:06:13 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: misc X-Bugzilla-Version: Unspecified X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: 000.fbsd@quip.cz X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: pf@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: cc Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Technical discussion and general questions about packet filter (pf) List-Archive: https://lists.freebsd.org/archives/freebsd-pf List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-pf@freebsd.org X-BeenThere: freebsd-pf@freebsd.org MIME-Version: 1.0 X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D256410 Miroslav Lachman <000.fbsd@quip.cz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |000.fbsd@quip.cz --- Comment #5 from Miroslav Lachman <000.fbsd@quip.cz> --- Wouldn't it be better to use pf_check() befor loading ruleset in pf_start()= and then decide if "default" ruleset should be loaded? Many rc script do check for syntax errors in config files before loading / running the daemon (Apache, Lighttpd, Nginx...) If will be useful to run this check before service pf start / reload / rest= art commands in general. Ad if there can be any default rule(s) to load if something failed then it = will be good to have some option to load rules from file not just the one line f= rom variable too. On some remote boxes it is better to left SSH (or somethng else) open if loading of rules failed than block everything. Something like this comes to my mind: if check of pf.conf failed check if /etc/pf.conf.default is a file & try to load it if pf.conf.default does not exist, use one line rule from pf_default_rules variable Of course pf.conf.default can be named differently, or can by /etc/defaults/pf.conf etc. --=20 You are receiving this mail because: You are the assignee for the bug.= From nobody Sun Jun 6 09:04:19 2021 X-Original-To: pf@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 2C3B595E7CF for ; Sun, 6 Jun 2021 09:04:20 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4FyVtX0clxz3wQ1 for ; Sun, 6 Jun 2021 09:04:20 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id F162E209FD for ; Sun, 6 Jun 2021 09:04:19 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 15694Jj1075816 for ; Sun, 6 Jun 2021 09:04:19 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 15694J8m075815 for pf@FreeBSD.org; Sun, 6 Jun 2021 09:04:19 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: pf@FreeBSD.org Subject: [Bug 256410] pf: Add pf_default_rules option Date: Sun, 06 Jun 2021 09:04:19 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: misc X-Bugzilla-Version: Unspecified X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: thomas@gibfest.dk X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: pf@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Technical discussion and general questions about packet filter (pf) List-Archive: https://lists.freebsd.org/archives/freebsd-pf List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-pf@freebsd.org X-BeenThere: freebsd-pf@freebsd.org MIME-Version: 1.0 X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D256410 --- Comment #6 from Thomas Steen Rasmussen / Tykling --- Hello Kristof :) Proposed commit message:=20 ----------------------------------------------------------------------- pf: Support loading small default pf ruleset in case of invalid pf.conf usi= ng pf_default_rules and pf_default_rules_enable When no pf rules are loaded pf will pass/allow all traffic if the kernel is compiled without PF_DEFAULT_TO_DROP, which is the case in GENERIC. This com= mit introduces a "pf default rules" concept to minimise the impact if a typo in pf.conf makes loading the firewall rules impossible on boot. The change checks the exit code of the $pf_program (pfctl) command when loa= ding pf.conf inside pf_start() in /etc/rc.d/pf. After this commit, if the exit c= ode is 1 and pf_default_rules_enable is set to YES, then the rules defined in $pf_default_rules are loaded instead. $pf_default_rules defaults to a single rule: "block drop log all". This commit also introduces new warn() calls when /etc/rc.d/pf fails to load the pf ruleset in pf_start(). If $pf_default_rules_enable is NO (which is t= he default) then the following messages are logged: /etc/rc.d/pf: WARNING: Unable to load pf.conf, and pf_default_rules_enable = is NO. /etc/rc.d/pf: WARNING: No pf rules are loaded, this means all traffic is permitted. If pf_default_rules_enable is YES then the following messages are logged, a= nd the rules defined in $pf_default_rules are loaded: /etc/rc.d/pf: WARNING: Unable to load pf.conf, and pf_default_rules_enable = is set to YES. /etc/rc.d/pf: WARNING: Loading pf_default_rules: block drop log all pf_default_rules can include multiple rules, for example to permit traffic = on a management interface. Seperate multiple rules with \n: $ sudo sysrc pf_default_rules pf_default_rules: block drop log all\npass quick on em0 $ The $pf_default_rules and $pf_default_rules_enable variables are defined in /etc/defaults/rc.conf with the following lines, preserving the existing functionality (apart from the new log messages): pf_default_rules_enable=3D"NO" # fallback to $pf_default_rules if loading ruleset fails pf_default_rules=3D"block drop log all" # block and drop everything if loa= ding pf ruleset fails PR: 256410 Reported by: Thomas Steen Rasmussen Reviewed by: kp@ Sponsored by: semaphor.dk ----------------------------------------------------------------------- Feel free to edit as you see fit :) Thank you! --=20 You are receiving this mail because: You are the assignee for the bug.= From nobody Sun Jun 6 09:09:46 2021 X-Original-To: pf@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id A663995FFD4 for ; Sun, 6 Jun 2021 09:09:46 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4FyW0p4GjSz4Rh4 for ; Sun, 6 Jun 2021 09:09:46 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 775AA20E24 for ; Sun, 6 Jun 2021 09:09:46 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 15699ktT076319 for ; Sun, 6 Jun 2021 09:09:46 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 15699kpE076318 for pf@FreeBSD.org; Sun, 6 Jun 2021 09:09:46 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: pf@FreeBSD.org Subject: [Bug 256410] pf: Add pf_default_rules option Date: Sun, 06 Jun 2021 09:09:46 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: misc X-Bugzilla-Version: Unspecified X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: thomas@gibfest.dk X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: pf@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Technical discussion and general questions about packet filter (pf) List-Archive: https://lists.freebsd.org/archives/freebsd-pf List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-pf@freebsd.org X-BeenThere: freebsd-pf@freebsd.org MIME-Version: 1.0 X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D256410 --- Comment #7 from Thomas Steen Rasmussen / Tykling --- (In reply to Chris Hutchinson from comment #4) Don't feel bad :) Your point about having a backup/safe/default pf.conf is certaintly valid. = That would not have helped here though, as there is no mechanism (without this patch) to load that alternative ruleset if the primary one fails. It would have to be done manually, which would require that you know when t= his happens - and if you know about a typo you would probably just fix it :) The code to automatically load an alternate ruleset from a file would look a lot like the code in my proposed patch. I opted for using an rc variable ov= er a file to avoid having an extra file in the tree which will very rarely be us= ed. Ideally the patch could be adapted to support loading from a file if one exists, and otherwise falling back to the rc variable. --=20 You are receiving this mail because: You are the assignee for the bug.= From nobody Sun Jun 6 09:13:51 2021 X-Original-To: pf@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id A613A960E8C for ; Sun, 6 Jun 2021 09:13:51 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4FyW5W44Txz4Sl2 for ; Sun, 6 Jun 2021 09:13:51 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 73DD821020 for ; Sun, 6 Jun 2021 09:13:51 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 1569DpYE079348 for ; Sun, 6 Jun 2021 09:13:51 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 1569Dpj4079347 for pf@FreeBSD.org; Sun, 6 Jun 2021 09:13:51 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: pf@FreeBSD.org Subject: [Bug 256410] pf: Add pf_default_rules option Date: Sun, 06 Jun 2021 09:13:51 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: misc X-Bugzilla-Version: Unspecified X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: thomas@gibfest.dk X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: pf@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Technical discussion and general questions about packet filter (pf) List-Archive: https://lists.freebsd.org/archives/freebsd-pf List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-pf@freebsd.org X-BeenThere: freebsd-pf@freebsd.org MIME-Version: 1.0 X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D256410 --- Comment #8 from Thomas Steen Rasmussen / Tykling --- (In reply to Miroslav Lachman from comment #5) pf_check() is actually defined, just not used, pf_resync() also checks the = exit code for some reason, I am not sure why. The patch could be adapted to run pf_check() instead of checking the exit code. Your point about supporting a rule file is also valid, see my other comment. --=20 You are receiving this mail because: You are the assignee for the bug.= From nobody Sun Jun 6 19:59:51 2021 X-Original-To: pf@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 347909757A5 for ; Sun, 6 Jun 2021 19:59:52 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4FynQw0mr4z3qGf for ; Sun, 6 Jun 2021 19:59:52 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 0313316AB for ; Sun, 6 Jun 2021 19:59:52 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 156JxpJm011861 for ; Sun, 6 Jun 2021 19:59:51 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 156Jxpqq011860 for pf@FreeBSD.org; Sun, 6 Jun 2021 19:59:51 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: pf@FreeBSD.org Subject: [Bug 256410] pf: Add pf_default_rules option Date: Sun, 06 Jun 2021 19:59:51 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: misc X-Bugzilla-Version: Unspecified X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: portmaster@bsdforge.com X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: pf@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Technical discussion and general questions about packet filter (pf) List-Archive: https://lists.freebsd.org/archives/freebsd-pf List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-pf@freebsd.org X-BeenThere: freebsd-pf@freebsd.org MIME-Version: 1.0 X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D256410 --- Comment #9 from Chris Hutchinson --- (In reply to Thomas Steen Rasmussen / Tykling from comment #7) > Ideally the patch could be adapted to support loading from > a file if one exists, and otherwise falling back to the rc variable. +1 on this. That would be my _preferred_ course of action in the event of failure. IMHO it should be up to the administrator as to _what_ ruleset should be enacted in the event of failure. Pretty much impossible to know what circumstances pf(4) are implimented for in any given situation. To be clear; I'm _not_ objecting to your proposed feature. :-) I'm simply attempting to _enhance_ it to DTRT. ;-) --Chris --=20 You are receiving this mail because: You are the assignee for the bug.= From nobody Sun Jun 6 21:00:34 2021 X-Original-To: pf@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id E562613C90FE for ; Sun, 6 Jun 2021 21:00:35 +0000 (UTC) (envelope-from bugzilla-noreply@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Fypmy6rDfz4RDV for ; Sun, 6 Jun 2021 21:00:34 +0000 (UTC) (envelope-from bugzilla-noreply@FreeBSD.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id C2B2E23C6 for ; Sun, 6 Jun 2021 21:00:34 +0000 (UTC) (envelope-from bugzilla-noreply@FreeBSD.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 156L0YhA046353 for ; Sun, 6 Jun 2021 21:00:34 GMT (envelope-from bugzilla-noreply@FreeBSD.org) Received: (from bugzilla@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 156L0YSY046352 for pf@FreeBSD.org; Sun, 6 Jun 2021 21:00:34 GMT (envelope-from bugzilla-noreply@FreeBSD.org) Message-Id: <202106062100.156L0YSY046352@kenobi.freebsd.org> X-Authentication-Warning: kenobi.freebsd.org: bugzilla set sender to bugzilla-noreply@FreeBSD.org using -f From: bugzilla-noreply@FreeBSD.org To: pf@FreeBSD.org Subject: Problem reports for pf@FreeBSD.org that need special attention Date: Sun, 6 Jun 2021 21:00:34 +0000 List-Id: Technical discussion and general questions about packet filter (pf) List-Archive: https://lists.freebsd.org/archives/freebsd-pf List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-pf@freebsd.org X-BeenThere: freebsd-pf@freebsd.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="16230132343.04C7.45441" Content-Transfer-Encoding: 7bit X-ThisMailContainsUnwantedMimeParts: Y --16230132343.04C7.45441 Date: Sun, 6 Jun 2021 21:00:34 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" To view an individual PR, use: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=(Bug Id). The following is a listing of current problems submitted by FreeBSD users, which need special attention. These represent problem reports covering all versions including experimental development code and obsolete releases. Status | Bug Id | Description ------------+-----------+--------------------------------------------------- Open | 203735 | Transparent interception of ipv6 with squid and p Open | 237973 | pf: implement egress keyword to simplify rules ac 2 problems total for which you should take action. --16230132343.04C7.45441--